ID. Date of interview 
date 13/12/19 


ID. Time interview started 
start 15:23:58 


ID.end Completion date of interview 
Date 43/12/19 


ID.end Time interview ended 
16:05:55 


ID. Duration of interview 
time 41.95 


Start of new case 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 
O Yes 
© No 


©) Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


The guidance does not cover the situation where a SAR is clearly being made but there is no clarity as to 
what the individual is looking for (i.e. they keep changing what information they want, are unclear as to 
what specifically they are looking for). Our understanding is that previously the time limit did not start to 
run until the SAR was clarified (on the basis that it is not a valid request and it is impossible to process it) 
but this appears to no longer be the case. It would be helpful to understand the basis on which the 
position has changed. | fear it will result in a lot of confusion, and organisations will instead seek an 
extension if they are unable to process the request within one month. The guidance does not make it 
clear whether the time limit for a response starts to run when it is made on behalf of a third party before 
any required authority from that third party is received. For example, in a school context, if a parent 
makes a request on behalf of their child, but the child has capacity to understand his/her own data rights, 
a school will usually seek consent from the pupil. It is our understanding that the request is not valid and 
the time limit will not start to run until such consent is received, but it would helpful if the guidance could 
confirm this. The guidance does not go into enough detail about the assumption of reasonableness for 
education related workers and whether this assumption is rebuttable. It would be helpful if the guidance 
could clarify whether it would only be reasonable to disclose education related workers' data when they 
are acting in their professional capacity. There is no further guidance on what the ‘serious harm test is. 


Q3 


Does the draft guidance contain enough examples? 
O) Yes 
© No 
©) Unsure / don't know 


If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


The guidance states that a requester is entitled to ask for all information held and organisations must 
make ‘reasonable searches’ for the information covered in the request. It would be helpful to have an 
example of what ‘reasonable searches' might mean, in particular in relation for searches on online 
systems when the requester has a common name. An example of when the assumption of 


reasonableness for education workers may not apply would be helpful, as would an example of when the 
‘serious harm test' might be applied. 


Q4 We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 
unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 
from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 
requests below (if applicable). 


A disgruntled parent who has two (or more) children at a school makes a SAR for 
everything the school holds on each member of the family - the family name is 
WE and the parent has specifically asked for searches to be made under this 
name. The schools asks the parent to clarify the request but they refuse and even 
say they are trying to make life difficult for the school as they are not looking for 
anything in particular. *please note it is not necessarily our view that this amounts 
to a manifestly unfounded or excessive request, but it is the kind of request we are 
often asked to advise on* 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-—Slightly Moderately 4-Very 5- Extremely 
useful useful useful useful useful 


© 


Q6 Why have you given this score? 


It is comprehensive but is not tailored to any specific sector. I work in the education 
sector and schools are experiencing a high number of SARs at the moment. Schools 
would welcome more specific advice and examples. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 


Q9 


Q10 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


I was hoping for greater clarity on the points raised on the earlier page of this 
survey. It is more detailed than the previous advice which is helpful, but as stated 
above, it is general and it would be helpful if the ICO could produce specific advice 
for schools with useful examples. A lot of the examples given are not relevant to the 
education sector. 


Are you answering as: 

O An individual acting in a private capacity (eg someone providing their views as a member of the public) 
©) An individual acting in a professional capacity 

(C) On behalf of an organisation 

(C) Other 

Please specify the name of your organisation: 

stone king Ilp 

What sector are you from: 


legal (working in the education sector) 


How did you find out about this survey? 
( `) ICO Twitter account 

(_) ICO Facebook account 

(`) ICO LinkedIn account 

(C) ICO website 

( `) ICO newsletter 

(_) ICO staff member 

C`) Colleague 

(__) Personal/work Twitter account 
(_) Personal/work Facebook account 
©) Personal/work LinkedIn account 
C) Other 

If other please specify: 


